From December 2023 to the present, QiAnXin Threat Intelligence Center observed that a ransomware written in rust language is very active on the Chinese Internet, and a large number of machines in China have been ransomed, with up to more than 20 victimized units only in the terminals of government and enterprises, which the researchers call Rast ransomware.
After a long time of tracking, QiAnXin Threat Intelligence Center have captured three versions of Rast ransomware, and the versions are still iterating. rast ransomware has a very special logic: after the ransomware is completed, it will upload the machine name and unique identifier of the local machine to the remote mysql database. Through reverse analysis the research team got the mysql database account password and statistics of victims in the database, and found that in just ten months more than 6,800 terminals were controlled.
Read more…
Source: QiAnXin Threat Intelligence Center
Related:
- Tracking the recent activities of the APT-Q-27
November 12, 2024
Overview In May 2022, Qi’anxin Threat Intelligence Center published an article titled “Operation Dragon Breath (APT-Q-27): A Dimensionality Reduction Attack on the Gambling Industry”, disclosing the attack activities of GoldenEyeDog (Qi’anxin internal tracking number APT-Q-27) against the gambling industry, and at the end of the article introduced the Miuuti Group —— an attack group targeting ...
- Amazon Confirms Employee Data Was Exposed Through MOVEit Breach
November 12, 2024
In a significant development that underscores the lasting impact of 2023’s MOVEit vulnerability, Amazon has confirmed that employee data was compromised through a third-party property management vendor. The breach, revealed by a threat actor known as “Nam3L3ss,” exposes the continuing ripple effects of one of last year’s most devastating supply chain attacks. The compromise stems from ...
- AT&T, Ticketmaster data breach hackers charged with stealing 50 billion records
November 12, 2024
The U.S. has indicted two individuals, Connor Moucka and John Binns, according to new documents, for hacking third-party cloud data storage and analytics company Snowflake. The Snowflake hack led to data breaches at numerous companies using the platform such as AT&T, Ticketmaster, and more than 150 other corporations. Read more… Source: MSN News Sign up for our Newsletter Related:
- New Google Chrome Warning As ‘No 0-Day’ Drive-By Cyber Attack Confirmed
November 12, 2024
The cost of zero-day exploits has always been high, especially if they allow an attacker to remotely execute code on a host machine. But why pay hundreds of thousands of dollars for an 0-day when a relatively simple drive-by attack doesn’t need one and can achieve much the same result? That’s what interested an Imperva security ...
- Pentagon leaker Jack Teixeira sentenced to 15 years in prison
November 12, 2024
Jack Teixeira, a member of the Massachusetts National Guard, has been jailed for 15 years for leaking classified documents about the war in Ukraine and other military secrets. A federal judge in Boston, United States, on Tuesday sentenced the 22-year-old after he pleaded guilty earlier this year to six counts of wilful retention and transmission of ...
- Hot Topic data breach thought to have hit nearly 54 million customers
November 12, 2024
Breach notification site Have I Been Pwned has confirmed the personal data of 56,904,909 users was found online, leaked from Hot Topic, Torrid, and Box Lunch customers. Threat actor ‘Satanic’ claimed responsibility for the breach, which was allegedly carried out through an infostealer infection, and made possible by weak security practices. The dataset is reportedly on ...